CVE-2025-7684 is a Cross-Site Request Forgery vulnerability in the Last.fm Recent Album Artwork WordPress plugin by remysharp. The issue arises from missing or incorrect nonce validation on the 'lastfm_albums_artwork.php' page, enabling attackers to forge requests that can update plugin settings or inject malicious web scripts if a site administrator is tricked into clicking a crafted link. This affects all versions up to and including 1.0.2. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation could allow an attacker to modify plugin settings and inject malicious scripts by leveraging an administrator's authenticated session via a forged request. This can lead to partial confidentiality and integrity loss within the affected WordPress site. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should avoid clicking on untrusted links while logged into WordPress and consider disabling or removing the vulnerable plugin. Monitoring vendor channels for updates is recommended.